Getting AccessTokenRefreshError 'invalid_grant' on dev_appserver when using cloudstorage

Question

When trying out the Google Cloud Storage sample (or any call to write files using the cloudstorage module, in other projects as well) I am getting a the following error

INFO     2016-12-05 01:16:06,999 client.py:804] Refreshing access_token
INFO     2016-12-05 01:16:07,198 client.py:827] Failed to retrieve access token: {
  "error" : "invalid_grant"
}
ERROR    2016-12-05 01:16:07,200 api_server.py:272] Exception while handling service_name: "app_identity_service"
method: "GetAccessToken"
request: "\n7https://www.googleapis.com/auth/devstorage.full_control"
request_id: "YpfXhQJczA"

... long long stack traces ...

RuntimeError: AccessTokenRefreshError(u'invalid_grant',)

Trouble is, when I deploy the app to Google App Engine, the call works just fine.

Answer 1

I spent a few hours searching and debugging the client code till I found out that the oauth2client was using some default application credentials stored somewhere in the file system. It seems that these credentials, which were probably left over from a previous version of the GAE SDK included an old refresh token that got rejected by Google.

On windows those credentials were stored in

C:\Users\$USER\AppData\Roaming\gcloud\application_default_credentials.json

The easy way to recreate these credentials is with the gcloud tool:

$ gcloud auth application-default login

(Note that gcloud auth login only sets up credentials for working with the gcloud utility itself, not for your app calling Google client libraries, so is not what is needed here).

Hope this can save someone else a few hours.